Systems, such as electronic, electro-pneumatic and electro-hydraulic steering and braking systems, are currently implemented in vehicles and other machinery and equipment to take advantage of their versatility over purely mechanical, pneumatic and hydraulic systems. Such control systems commonly use pneumatic or hydraulic power as the muscle for the actual steering and breaking functions, and electrical components as the command for the precision control of the pneumatic and hydraulic components. These control systems are particularly advantageous in excavating machines where the hydraulic power is necessary to move the steering and braking components of the machine, as well as the excavating components. In the event of performance issues or failure of the primary electronic, electro-pneumatic or electro-hydraulic control systems, redundant control systems are typically implemented in concert with the primary systems to take over control of the controlled components of the machine when necessary.
In one exemplary arrangement, a redundantly controlled system may include a primary pilot control valve and a secondary or redundant pilot control valve that are used to control a main valve spool in the redundantly controlled system that can be, for example, a braking or steering system. These systems further include a pilot selector valve that directs pressurized pilot fluid to the primary and secondary pilot control valves depending on whether the primary control portion is operated or the redundant control portion is operating. In many previous implementations, the pilot selector valve is a simple on/off valve. Typically, a 100% electrical signal to the actuator of the pilot selector valve causes the pilot fluid to be provided to the primary pilot control valve, and a 0% electrical signal causes the pilot fluid to be provided to the redundant pilot control valve.
The operation of the controlled system and at the pilot selector valve may be controlled by one or both of a primary electronic control module (ECM) and a secondary or redundant ECM. During normal operation, the primary ECM may operate to perform control of the components of the redundantly controlled system, and one of the ECM's transmits signals to the actuator of the pilot selector valve to direct pilot fluid to the primary pilot control valve. Upon detection of a fault condition in the primary control components or the primary ECM, the redundant ECM assumes control of the redundantly controlled system and transmits signals to the actuator of the pilot selector valve, or omits transmitting signals to the actuator, to cause the pilot selector valve to direct pilot fluid to the redundant pilot control valve.
Despite this design, it is possible for conditions to exist where the primary and redundant ECM's do not function properly to perform either the primary or redundant control strategies. For example, the redundant ECM may attempt to assume control due to a false positive detection of a fault in the primary control elements, and expect the pilot fluid to be delivered by the pilot selector valve to the secondary pilot control valve. If the primary ECM continues to perform its control functions, signals from the primary ECM will cause the primary control elements to attempt to perform the primary control strategy while the redundant ECM transmits control signals to the secondary control elements of the controlled system to attempt to perform the primary control strategy. In previous systems, mechanisms do not exist to detect the occurrence of these types of errors by the ECM's and reestablish proper control of the controlled system. In view of this, a need exists for methods and apparatus for failsafe operation of a pilot selector valve and control of the components of the redundantly controlled system.